CVE-2026-27125
Medium · 6.8CVSS
6.8
EPSS
0.6%
Published
Feb 20, 2026
CISA due date
—
The record
svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | svelte | 0 | 5.51.5 |
| Chainguard | langfuse-3-worker | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.163.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.163.0-r0 |
Related vulnerabilities
- GHSA-crpf-4hrx-3jrp Svelte SSR attribute spreading includes inherited properties from prototype chain Same vulnerability
- CVE-2026-42567 Svelte is a performance oriented web framework. Also affects svelte
- CVE-2026-42599 Svelte is a performance oriented web framework. Also affects svelte
- CVE-2026-42573 Svelte is a performance oriented web framework. Also affects svelte
- GHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratable Also affects svelte
- GHSA-rcqx-6q8c-2c42 Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State Also affects svelte
- GHSA-9rmh-mm8f-r9h6 Svelte: ReDoS in `` Tag Validation Also affects svelte
- GHSA-pr6f-5x2q-rwfp Svelte SSR vulnerable to cross-site scripting via spread attributes Also affects svelte